Dashboards & Visualizations

how to display the events for the Count

mmengu416
New Member

Hi All,

I am trying to display the events of the "count"(which is of multiple fields), how do I do that?
I am using the append/appendcol command to combine 2 queries and display its count. when I click the "count" it is taking me to the same query.

Tags (1)
0 Karma

mmengu416
New Member

HI Anantha,
Thank you for the response,
yes, that is the query I am using. Assume I am using the query "Query1 | stats count as total1 | append[search Query2 | stats count as total2] | eval Total=total1+total2 | table Total" When I want to triage the "Total" events and click on the "Total" in Splunk, instead of displaying the events, it is taking me to the same query in another tab. the "Total" field does not provide the total events instead it is taking me to the same query "Query1 | stats count as total1 | append[search Query2 | stats count as total2] | eval Total=total1+total2 | table Total."

0 Karma

Anantha123
Communicator

hi, Can you elaborate your question .
But for start if you want to count multiple fields then you can use like
|timechart count as Total, count(eval(status=success)) as Success, count(eval(field=A)) as FieldATotal .
You can also use stats instead of timechart .

If you want to count no of events from 2 different queries , then try
Query1 | stats count as total1 | append[search Query2 | stats count as total2] | eval Total=total1+total2 | table Total.

Let us know if you are looking something else here.
Thanks
Anantha.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...